Vulnerability processing result checking method and device, electronic equipment and storage medium

Abstract

The application discloses a vulnerability processing result checking method and device, electronic equipment and a storage medium. The application relates to the field of artificial intelligence. The method comprises the following steps: obtaining a vulnerability scanning result obtained by scanning business code by a vulnerability scanning system; obtaining vulnerability processing information corresponding to the vulnerability scanning result by processing the vulnerability scanning result by an operation and maintenance user; checking the vulnerability processing information corresponding to the vulnerability scanning result according to the vulnerability scanning result and the corresponding vulnerability processing information, and obtaining a vulnerability repair checking result; and when the vulnerability repair checking result is checking failure, sending re-repair information to the operation and maintenance user, so that the operation and maintenance user processes the vulnerability scanning result corresponding to the re-repair information. The technical scheme of the application improves the efficiency of vulnerability processing result checking.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of artificial intelligence, and in particular to a method, apparatus, electronic device and storage medium for verifying vulnerability processing results. Background Technology

[0002] For applications and systems, code vulnerability scanning is especially important.

[0003] Code is typically scanned by vulnerability scanning systems, which generate vulnerability scan results when security vulnerabilities are detected. System administrators then process these results to generate appropriate vulnerability handling information. To ensure application and system security, this vulnerability handling information also needs to be verified.

[0004] Currently, the verification of vulnerability handling information mainly relies on manual verification. However, manual verification is labor-intensive and inefficient. Summary of the Invention

[0005] This invention provides a method, apparatus, electronic device, and storage medium for verifying vulnerability processing results, which automates the verification of vulnerability processing results and improves the efficiency of vulnerability processing result verification.

[0006] In a first aspect, embodiments of the present invention provide a method for verifying vulnerability processing results, including:

[0007] Obtain vulnerability scan results from the vulnerability scanning system that scans the business code.

[0008] The system obtains and processes the vulnerability scan results from operations and maintenance users to obtain vulnerability handling information corresponding to the vulnerability scan results. This vulnerability handling information includes the vulnerability handling status.

[0009] Based on the vulnerability scanning results and the corresponding vulnerability handling information, the vulnerability handling information corresponding to the vulnerability scanning results is verified to obtain the vulnerability remediation verification results; the verification includes at least one of the following: standardization verification, correctness verification and remediation result verification.

[0010] If the vulnerability repair verification result fails, a re-repair message is sent to the operations and maintenance user so that the operations and maintenance user can process the vulnerability scan results corresponding to the re-repair message.

[0011] Secondly, embodiments of the present invention also provide a vulnerability processing result verification device, comprising:

[0012] The vulnerability scan result acquisition module is used to acquire the vulnerability scan results obtained by the vulnerability scanning system from scanning the business code.

[0013] The vulnerability handling information acquisition module is used to acquire vulnerability scanning results processed by operation and maintenance users and obtain vulnerability handling information corresponding to the vulnerability scanning results. The vulnerability handling information includes the result after the vulnerability code is repaired and the vulnerability handling status.

[0014] The vulnerability handling information verification module is used to verify the vulnerability handling information corresponding to the vulnerability scanning results based on the vulnerability scanning results and the corresponding vulnerability handling information, and to obtain the vulnerability remediation verification results; the verification includes at least one of the following: standardization verification, correctness verification and remediation result verification.

[0015] The re-repair information sending module is used to send re-repair information to the operations and maintenance user when the vulnerability repair verification result is a failure, so that the operations and maintenance user can process the vulnerability scan results corresponding to the re-repair information.

[0016] Thirdly, embodiments of the present invention also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the vulnerability processing result verification method as described in any of the embodiments of the present invention.

[0017] Fourthly, embodiments of the present invention also provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the vulnerability processing result verification method as described in any of the embodiments of the present invention.

[0018] Fifthly, embodiments of the present invention also provide a computer program product, including a computer program that, when executed by a processor, implements the vulnerability processing result verification method as described in any of the embodiments of the present invention.

[0019] The technical solution of this invention obtains vulnerability scanning results from a vulnerability scanning system scanning business code; obtains vulnerability handling information corresponding to the vulnerability scanning results through processing by the operation and maintenance user; verifies the vulnerability handling information corresponding to the vulnerability scanning results based on the vulnerability scanning results and the corresponding vulnerability handling information to obtain vulnerability repair verification results; and sends re-repair information to the operation and maintenance user when the vulnerability repair verification result fails, so that the operation and maintenance user can process the vulnerability scanning results corresponding to the re-repair information, thereby automating the vulnerability handling result verification and improving the efficiency of vulnerability handling result verification. Attached Figure Description

[0020] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 A flowchart of a vulnerability processing result verification method provided in an embodiment of the present invention;

[0022] Figure 2 A flowchart of a vulnerability processing result verification method provided in an embodiment of the present invention;

[0023] Figure 3 A flowchart of a vulnerability processing result verification method provided in an embodiment of the present invention;

[0024] Figure 4 A scenario diagram illustrating a vulnerability processing result verification method provided in an embodiment of the present invention;

[0025] Figure 5 This is a schematic diagram of the structure of a vulnerability processing result verification device provided in an embodiment of the present invention;

[0026] Figure 6 This is a schematic diagram of the structure of an electronic device applicable to a vulnerability processing result verification method provided in an embodiment of the present invention. Detailed Implementation

[0027] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, the accompanying drawings show only the parts relevant to the present invention, and not all of the structures.

[0028] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this invention, terms such as "first," "second," etc., are used only for distinguishing descriptions and should not be construed as indicating or implying relative importance. The acquisition, storage, use, and processing of data in the technical solutions of this invention's embodiments all comply with relevant national laws and regulations.

[0029] Figure 1This is a flowchart illustrating a vulnerability processing result verification method provided in an embodiment of the present invention. This embodiment is applicable to situations where vulnerability processing results are verified without human intervention. The method can be executed by a vulnerability processing result verification device, which can be implemented in hardware and / or software. This device can be configured in an electronic device that carries the vulnerability processing result verification function, particularly in a client-side application.

[0030] See Figure 1 The vulnerability handling result verification method shown includes:

[0031] S110. Obtain the vulnerability scanning results obtained by the vulnerability scanning system from scanning the business code.

[0032] Business code can be the code required for the operation of a business system. A vulnerability scanning system scans this business code to detect vulnerabilities. If a vulnerability is detected, the system outputs the vulnerability scan results. These results can include the vulnerable code and its corresponding vulnerability information.

[0033] S120. Obtain the vulnerability scan results from the operation and maintenance user and process them to obtain the vulnerability handling information corresponding to the vulnerability scan results. The vulnerability handling information includes the vulnerability handling status.

[0034] After obtaining the vulnerability scan results, the operations and maintenance user will process them to obtain corresponding vulnerability handling information. This vulnerability handling information can be the information obtained after processing the vulnerability scan results. Specifically, the vulnerability handling information may include the vulnerability handling status. For example, the vulnerability handling status may include the status type and the reason for the status type.

[0035] S130. Based on the vulnerability scanning results and the corresponding vulnerability handling information, verify the vulnerability handling information corresponding to the vulnerability scanning results to obtain vulnerability remediation verification results; the verification includes at least one of the following: standardization verification, correctness verification and remediation result verification.

[0036] The vulnerability remediation verification result is used to verify whether the vulnerability has been resolved.

[0037] The compliance check is used to detect whether the content of the vulnerability handling status conforms to the specifications. Optionally, the compliance check may include checking the data format and / or content of the vulnerability handling status for compliance. For example, the compliance check may include checking whether the content of the vulnerability handling status conforms to data specifications. Specifically, the vulnerability handling status can be checked using a first verification sub-model to determine whether the vulnerability handling status conforms to the specifications. Optionally, the verification model may include the first verification sub-model. Optionally, the first verification sub-model may also be a model that performs compliance checks independently.

[0038] Correctness detection can be used to check whether the vulnerability handling status is correct. For example, the vulnerability handling status can include status A. If the vulnerability handling status is marked as status A, then correctness detection actually checks whether the vulnerability handling status is status A. Specifically, a second verification sub-model can be used to perform vulnerability detection on the result after the vulnerability code is fixed to determine whether the vulnerability handling status is correct. Optionally, the verification model can include a second verification sub-model. Optionally, the second verification sub-model can also be a model that performs correctness detection independently.

[0039] Repair result detection can be used to determine whether problematic code has been patched. Specifically, a third verification sub-model can be used to perform vulnerability detection on the patched code to determine whether the vulnerability has been fixed. Optionally, the verification model can include a third verification sub-model. Optionally, the third verification sub-model can also be an independent model for repair result detection.

[0040] By specifying the verification to include at least one of the following: standardization verification, correctness verification, and remediation result verification, the verification of vulnerability handling information is implemented in a more targeted manner, improving the flexibility of vulnerability handling information verification.

[0041] S140. When the vulnerability repair verification result is a failure, send a re-repair information to the operation and maintenance user so that the operation and maintenance user can process the vulnerability scan result corresponding to the re-repair information.

[0042] The remediation information can be information on reprocessing vulnerability scan results. Users of vulnerability remediation information can be operations and maintenance personnel who process vulnerability scan results and generate vulnerability remediation information.

[0043] Specifically, if the vulnerability remediation verification fails, a remediation message is sent to the operations and maintenance user who generated the vulnerability handling information. Upon receiving the remediation message, the operations and maintenance user reprocesses the vulnerability scan results and regenerates the vulnerability handling information, enabling the user to process the vulnerability scan results corresponding to the remediation message.

[0044] The technical solution of this invention obtains vulnerability scanning results from a vulnerability scanning system targeting business code, and then allows operations and maintenance users to process these results to obtain vulnerability handling information corresponding to the vulnerability scanning results. This vulnerability handling information includes a vulnerability handling status. Based on the vulnerability scanning results and the corresponding vulnerability handling information, the vulnerability handling information is verified to obtain a vulnerability remediation verification result. This verification includes at least one of the following: compliance verification, correctness verification, and remediation result verification. If the vulnerability remediation verification result fails, remediation information is sent to the operations and maintenance user so that the user can process the vulnerability scanning results corresponding to the remediation information. By automatically verifying the vulnerability handling information, the verification of vulnerability handling results is automated, improving the efficiency of vulnerability handling result verification and ensuring the security and stability of the system.

[0045] In an optional embodiment of the present invention, the verification includes normative verification, which verifies the vulnerability handling status, including: performing standardized detection on the data format and content of the vulnerability handling status.

[0046] The data format for vulnerability handling status can be the format of each item in the vulnerability handling status. Optionally, the data format can include data type and content format. The content of the vulnerability handling status can include the required fields for each item. Each required field contains corresponding attribute values.

[0047] For example, assume that the vulnerability handling status has two types: Status Type X and Status Type Y. The content of the vulnerability handling status includes the status type, the reason for the status type, and a note. The data format for the status type is numerical, while the data format for the reason and note is text. The required elements in each item of the vulnerability handling status are the status type and the reason for the status type. The attribute values ​​in the status type content can include the numerical values ​​"1" and "2". If the status type is Status Type X, the corresponding content is the numerical value "1"; if the status type is Status Type Y, the corresponding content is the numerical value "2". The attribute values ​​in the reason for the status type can include the vulnerability code, processing information, and the result after the vulnerability code is fixed.

[0048] Standardized testing of the data format for vulnerability processing status can detect whether the status type data format is numerical, whether the reason for the vulnerability is text-based, and whether the remarks data format is text-based. If any other data format is detected, the standardized testing of the vulnerability processing status data format fails.

[0049] Standardizing the content of vulnerability handling status checks can help identify whether essential information is missing. Specifically, it checks whether required fields for each field in the vulnerability handling status are filled in, and whether the attribute values ​​for those required fields are entered. If a required field is missing, or if a required field is filled in but the corresponding attribute value is missing, the vulnerability handling status is considered to be lacking essential information, and the compliance check fails.

[0050] This solution standardizes the data format and content of vulnerability handling status, thereby verifying the compliance of vulnerability handling status in terms of data format and content, and ensuring the compliance of vulnerability handling status.

[0051] In an optional embodiment of the present invention, the verification includes correctness verification, which verifies the vulnerability handling status, including: performing vulnerability detection on the false alarm issue code corresponding to the false alarm status in the vulnerability handling status; and determining whether the vulnerability scanning result corresponding to the false alarm issue code is a false alarm result.

[0052] A false positive status can be a state where the problematic code in a vulnerability scan does not contain a vulnerability. Vulnerability handling status types include false positive status. The problematic code in a false positive status can be the result of handling the vulnerable code in a false positive status. The false positive result can be a verification result confirming that the false positive status is correct.

[0053] Specifically, the system can detect the false alarm code corresponding to the false alarm status, and check whether the false alarm code has the characteristics of the vulnerability corresponding to the missed scan result. If the characteristics of the vulnerability corresponding to the missed scan result are present, the vulnerability detection result is that a vulnerability exists, which can be understood as a false alarm result. If the characteristics of the vulnerability corresponding to the vulnerability scan result are not present, the vulnerability detection result is that no vulnerability exists, which can be understood as a non-false alarm result.

[0054] This solution performs vulnerability detection on the falsely reported vulnerability code corresponding to the falsely reported vulnerability status in the vulnerability handling status, determines whether the vulnerability scan result corresponding to the falsely reported vulnerability code is a false alarm, and verifies the correctness of the falsely reported status in the vulnerability handling status. This achieves a second verification of vulnerability handling information, avoids incorrect judgment of falsely reported status and omission of real vulnerabilities, and further improves the accuracy of vulnerability handling.

[0055] In an optional embodiment of the present invention, vulnerability detection is performed on the problematic code corresponding to the false positive status in the vulnerability handling status, and it is determined whether the vulnerability scanning result corresponding to the false positive problematic code is a false positive result. This includes: obtaining the false positive problematic code and the false positive context corresponding to the false positive status in the vulnerability handling information; detecting whether the false positive problematic code and the false positive context have characteristics of the vulnerability scanning result corresponding to the false positive problematic code; if they do, determining the vulnerability scanning result corresponding to the false positive problematic code as a vulnerability detection result; if they do not, determining the vulnerability scanning result of the false positive problematic code as a false positive result.

[0056] False positive context can be the context information of the falsely reported problematic code. The characteristics of a false negative scan result can be the characteristics corresponding to the vulnerability identified by the vulnerability scan result. If the characteristics of a false negative scan result exist, then it is determined that a vulnerability exists in the falsely reported problematic code. Optionally, the characteristics of the vulnerability scan result can be a partial code snippet of the problematic code in the vulnerability scan result. For example, the characteristics of the vulnerability scan result may include: a close code snippet in the finally block of the problematic code corresponding to an Unreleased Resource vulnerability, a globally filtered code snippet in the false positive context corresponding to a Cross-Site Scripting vulnerability, or a character escape code snippet in the false positive context of a Cross-Site Scripting vulnerability, etc.

[0057] Specifically, the second verification sub-model can be used to detect the characteristics of the falsely reported problematic code and the context of the false report, which correspond to the presence of vulnerabilities in the vulnerability scan results. If these characteristics exist, it is determined that the vulnerability scan result of the falsely reported problematic code is not a false report, and can be interpreted as the falsely reported problematic code having a vulnerability; if they do not exist, it is determined that the vulnerability scan result of the falsely reported problematic code is a false report, and can be interpreted as the falsely reported problematic code not having a vulnerability.

[0058] This solution increases the scope of code to be detected and improves the comprehensiveness of correctness detection by obtaining the false positive issue code and false positive context corresponding to the false positive status in the vulnerability handling status. By detecting whether the false positive issue code and false positive context have the characteristics of the vulnerability scan result corresponding to the false positive issue code, if they exist, the vulnerability scan result corresponding to the false positive issue code is determined to be the vulnerability detection result; if they do not exist, the vulnerability scan result of the false positive issue code is determined to be a false positive result. By detecting the characteristics of the vulnerability scan result, accurate detection of false positive issue code is achieved, further improving the efficiency of false positive issue code detection.

[0059] In an optional embodiment of the present invention, the vulnerability processing information corresponding to the vulnerability scanning results is verified based on the vulnerability scanning results and the corresponding vulnerability processing information to obtain a vulnerability remediation verification result. Specifically, this includes: inputting the vulnerability scanning results and the corresponding vulnerability processing information into a pre-trained verification model to obtain a vulnerability remediation verification result; the verification model is trained based on training samples, which include the vulnerability scanning results of sample code, the vulnerability processing information corresponding to the vulnerability scanning results of the sample code, and the vulnerability remediation verification result of the vulnerability scanning results of the sample code.

[0060] Validation models can include: linear regression models, logistic regression models, decision tree models, perceptron models, or convolutional neural network models, etc.

[0061] A validation model can be obtained by acquiring training samples and inputting them into an untrained model. The training samples can include: vulnerability scanning results of sample code, vulnerability handling information corresponding to the vulnerability scanning results of the sample code, and vulnerability remediation validation results of the vulnerability scanning results of the sample code. The sample code can be the vulnerability code corresponding to the vulnerability handling information that has been manually verified. The vulnerability remediation validation results of the vulnerability scanning results of the sample code can be the results of manual remediation and verification of the vulnerability handling information.

[0062] Specifically, when verifying vulnerability handling information, the vulnerability scan results and the corresponding vulnerability handling information can be input into a pre-trained verification model. The verification model verifies the vulnerability handling information and obtains the vulnerability remediation verification result.

[0063] This solution improves the accuracy and efficiency of vulnerability remediation verification by inputting vulnerability scanning results and corresponding vulnerability handling information into a pre-trained verification model. The verification model directly verifies the vulnerability handling information corresponding to the vulnerability scanning results.

[0064] In an optional embodiment of the present invention, the vulnerability scanning results and the corresponding vulnerability handling information are input into a pre-trained verification model to obtain vulnerability repair verification results. Specifically, this involves: obtaining the operating performance of the business system running the business code and determining the business operation constraint information of the business code; inputting the vulnerability scanning results, the corresponding vulnerability handling information, and the business operation constraint information of the business code into the pre-trained verification model to obtain vulnerability repair verification results; the training samples also include the business operation constraint information of the sample code.

[0065] Runtime performance can refer to the performance parameters of the business system where the business code resides. Business runtime constraint information can refer to the constraint conditions of the business system when running the business code.

[0066] The vulnerability scanning results of the sample code, the vulnerability handling information corresponding to the vulnerability scanning results of the sample code, the vulnerability repair verification results of the sample code, and the business operation constraint information of the sample code can be input into the untrained model to train the model and obtain the verification model.

[0067] Specifically, when verifying vulnerability handling information, the vulnerability scanning results, the vulnerability handling information corresponding to the vulnerability scanning results, and the business operation constraint information of the business code can be input into a pre-trained verification model. The verification model verifies the vulnerability handling information and obtains the vulnerability remediation verification result.

[0068] This solution incorporates the operational constraints of the business system as input to the verification model, taking into account the operational performance of the business system and further improving the accuracy of the verification model in verifying vulnerability repairs.

[0069] In an optional embodiment of the present invention, the method further includes: when the vulnerability repair verification result is successful, obtaining the false alarm issue code corresponding to the false alarm status in the vulnerability handling status; detecting the accuracy of candidate vulnerability scanning software based on the false alarm issue code; selecting target vulnerability scanning software based on the accuracy detection results; and optimizing the vulnerability scanning system based on the information associated with the target vulnerability scanning software and the information associated with the false alarm issue code.

[0070] A vulnerability scanning system can include various vulnerability scanning software. Vulnerability scanning software has limitations during the vulnerability scanning process and may produce false positives. Accuracy test results can include both accurate and inaccurate. Alternative vulnerability scanning software can be all software within the vulnerability scanning system capable of performing vulnerability scans. The target vulnerability scanning software can be one that has accuracy in scanning for problematic code flagged by false positives. Information associated with the target vulnerability scanning software can include its identification information. This identification information uniquely identifies the target vulnerability scanning software. Information associated with the problematic code flagged by false positives can include the flagged code itself and the context of the false positive.

[0071] Specifically, when the vulnerability remediation verification result is successful, the false positive vulnerability code is obtained. This false positive code can then be tested using alternative vulnerability scanning software. Based on the detection results of these alternative software programs, the accuracy of each software program is determined. If the detection indicates no vulnerability exists, the accuracy of that alternative software program is considered accurate; if it indicates a vulnerability exists, the accuracy is considered inaccurate. The alternative software program with the accurate accuracy is then designated as the target vulnerability scanning software. A mapping relationship can be established between the information associated with the target vulnerability scanning software and the information associated with the false positive vulnerability code, and this mapping can be stored in the vulnerability scanning system. When the vulnerability scanning system performs vulnerability scans on business code that is the same as or similar to the false positive vulnerability code, the system can automatically select the accurate vulnerability scanning software to scan the business code.

[0072] This solution verifies the accuracy of candidate vulnerability scanning software by using false positive error codes when the vulnerability remediation verification result is successful. Based on the accuracy verification result, target vulnerability scanning software is selected. The vulnerability scanning system is then optimized based on the information associated with the target vulnerability scanning software and the information associated with the false positive error codes. By utilizing the false positive error codes corresponding to the vulnerability remediation verification result, the accuracy of the vulnerability scanning system is improved, thereby enhancing the vulnerability scanning system's ability to combat vulnerabilities.

[0073] Figure 2 This is a flowchart of a vulnerability processing result verification method provided by an embodiment of the present invention. Based on the above embodiments, after obtaining the vulnerability remediation verification result, this embodiment further adds: obtaining the operational performance of the business system running the business code and determining the business operation constraint information of the business code; obtaining the problematic code corresponding to the failed vulnerability scan result; and correcting the vulnerability remediation verification result of the failed vulnerability scan result to a successful verification result when the problematic code corresponding to the failed vulnerability scan result meets the business operation constraint information.

[0074] See Figure 2 The vulnerability handling result verification method shown includes:

[0075] S210. Obtain the vulnerability scanning results obtained by the vulnerability scanning system from scanning the business code.

[0076] S220. Obtain the vulnerability scan results from the operation and maintenance user and process them to obtain the vulnerability handling information corresponding to the vulnerability scan results. The vulnerability handling information includes the vulnerability handling status.

[0077] S230. Based on the vulnerability scanning results and the corresponding vulnerability handling information, verify the vulnerability handling information corresponding to the vulnerability scanning results to obtain vulnerability remediation verification results; the verification includes at least one of the following: standardization verification, correctness verification, and remediation result verification.

[0078] S240. When the vulnerability repair verification result is a failure, send a re-repair information to the operation and maintenance user so that the operation and maintenance user can process the vulnerability scan result corresponding to the re-repair information.

[0079] S250. Obtain the operating performance of the business system running the business code, and determine the business operation constraint information of the business code.

[0080] Operational performance can refer to the performance parameters of the business system where the business code resides. Business operation constraint information can refer to the constraint conditions of the business system when running the business code. For example, business operation constraint information may include information such as the space occupied by the business code and the running speed of the business system. For instance, business operation constraint information could be that the space occupied by the business code is less than 100MB.

[0081] Specifically, based on the operational performance of the business system, the conditions that the business system needs to meet in terms of operational performance can be determined, thereby determining the business operation constraint information.

[0082] S260. Obtain the problematic code corresponding to the vulnerability scan results that failed to verify.

[0083] Issue code can be code obtained by operations and maintenance users after processing vulnerability scan results. Optionally, issue code can include false positive issue code and fix issue code.

[0084] Specifically, it can retrieve the problematic code corresponding to vulnerability scans that failed verification.

[0085] S270. When the problematic code corresponding to the vulnerability scan result that failed to be verified meets the business operation constraint information, the vulnerability repair verification result of the vulnerability scan result that failed to be verified is corrected to verification success.

[0086] Specifically, if the problematic code corresponding to a failed vulnerability scan meets the business operation constraints, it can be understood that the problematic code meets the requirements of the business system for business code. Therefore, the vulnerability remediation verification result of the failed vulnerability scan can be corrected to a successful verification.

[0087] Optionally, if the problematic code is a false alarm, and the false alarm code corresponding to the failed vulnerability scan meets the business operation constraints, then the false alarm code is considered to be a false alarm, and the vulnerability code corresponding to the vulnerability scan does not have a vulnerability. The verification failure is then corrected to a successful verification.

[0088] Optionally, if the problematic code is a fix code, and the fix code corresponding to the vulnerability scan result that failed the verification meets the business operation constraints, then the fix code is considered to have been fixed in accordance with the fix method required by the business system. This can be understood as the fix code having been rectified and meeting the usage requirements of the business system, and the verification failure is corrected to verification success.

[0089] In an optional embodiment of the present invention, when the problematic code corresponding to the successfully verified vulnerability scan result does not meet the business operation constraint information, the vulnerability repair verification result of the successfully verified vulnerability scan result is corrected to verification failure.

[0090] Specifically, if the problematic code corresponding to a successfully verified vulnerability scan result does not meet the business operation constraints, it can be understood that the problematic code does not meet the requirements of the business system for business code. Therefore, the vulnerability remediation verification result of the successfully verified vulnerability scan result can be corrected to verification failure.

[0091] Optionally, if the problematic code is a false alarm, and the false alarm code corresponding to the successfully verified vulnerability scan result does not meet the business operation constraints, then the false alarm code is considered not to be a false alarm. It can be understood that the vulnerability code corresponding to the vulnerability scan result has a vulnerability, and the successful verification is corrected to a failed verification.

[0092] Optionally, if the problematic code is a fix code, and the fix code corresponding to the successfully verified vulnerability scan result does not meet the business operation constraints, then it is considered that the fix code has not been fixed in accordance with the fix method required by the business system. This can be understood as the fix code not being rectified and unable to meet the usage requirements of the business system. In this case, the successful verification will be changed to a failed verification.

[0093] The technical solution of this invention obtains the operating performance of the business system running the business code and determines the business operation constraint information of the business code. It obtains the problematic code corresponding to the failed vulnerability scan results. When the problematic code corresponding to the failed vulnerability scan results meets the business operation constraint information, the vulnerability repair verification result of the failed vulnerability scan results is corrected to a successful verification result. By introducing business operation constraint information and using it to review the vulnerability repair verification results, the actual needs of the business system for vulnerability handling are considered, making the vulnerability handling result verification more targeted and improving the adaptability of vulnerability handling result verification to the business system.

[0094] It should be noted that for any parts not described in detail in the embodiments of the present invention, please refer to the description in the foregoing embodiments.

[0095] Figure 3 This is a flowchart of a vulnerability processing result verification method provided by an embodiment of the present invention. Based on the above embodiments, this embodiment specifies the verification as a repair result verification, and verifies the problematic code corresponding to the vulnerability scan result. Specifically, it involves: obtaining the repair problem code corresponding to the rectification status in the vulnerability processing status; and detecting whether the repair problem code has been rectified.

[0096] See Figure 3 The vulnerability handling result verification method shown includes:

[0097] S310. Obtain the vulnerability scanning results obtained by the vulnerability scanning system from scanning the business code.

[0098] S320. Obtain the vulnerability scan results from the operation and maintenance user and process them to obtain the vulnerability handling information corresponding to the vulnerability scan results. The vulnerability handling information includes the vulnerability handling status.

[0099] S330. Based on the vulnerability scan results and the corresponding vulnerability handling information, obtain the remediation code corresponding to the remediation status in the vulnerability handling status, check whether the remediation code has been rectified, and obtain the vulnerability remediation verification result; the verification includes remediation result verification.

[0100] The "Remediation Status" indicates that the problematic code corresponding to the vulnerability scan results has a vulnerability and has been remediated. "Repaired Problem Code" refers to the result of processing the vulnerable code corresponding to the "Remediation Status".

[0101] Specifically, it can detect whether the code that is being repaired contains the characteristics of the vulnerability corresponding to the vulnerability scan results. If the code that is being repaired contains the characteristics of the vulnerability corresponding to the vulnerability scan results, then the code that is being repaired still has a vulnerability and has not been rectified. If the code that is being repaired does not contain the characteristics of the vulnerability corresponding to the vulnerability scan results, then the code that is being repaired does not have a vulnerability and has been rectified.

[0102] S340. When the vulnerability repair verification result is a failure, send a re-repair information to the operation and maintenance user so that the operation and maintenance user can process the vulnerability scan result corresponding to the re-repair information.

[0103] The technical solution of this invention obtains the repair code corresponding to the rectification status in the vulnerability handling status, detects the repair code, and determines whether the repair code has been rectified, thereby realizing the detection of the repair result of the repair code and improving the detection efficiency of vulnerability handling information.

[0104] In an optional embodiment of the present invention, detecting whether the code that fixes the problem has been rectified is specifically defined as follows: obtaining the vulnerability type of the code that fixes the problem from the vulnerability scan results; querying the vulnerability database for the target feature corresponding to the vulnerability type of the code that fixes the problem; detecting whether the code that fixes the problem and the fix context have the target feature, the target feature including fix feature and / or vulnerability feature.

[0105] The vulnerability database stores the target characteristics of different vulnerability types. Specifically, it allows querying based on vulnerability type to retrieve the corresponding target characteristics. Optionally, the vulnerability database can also serve as input information for verification models or third-party verification sub-models.

[0106] The remediation context can be the contextual information for fixing the problematic code. Target features can include remediation features and / or vulnerability features. Remediation features can be the characteristics of the code obtained by fixing the vulnerability, i.e., the characteristics of the code that fixes the problematic code. Vulnerability features can be the characteristics that allow the vulnerability to exist in the code.

[0107] Optionally, based on the vulnerability information in the vulnerability scan results, the vulnerability characteristics corresponding to the fix code can be determined, and the fix code and fix context can be detected to determine whether vulnerability characteristics exist. If vulnerability characteristics exist, the fix code has not been rectified and the vulnerability has not been fixed; if vulnerability characteristics do not exist, the fix code has been rectified.

[0108] Optionally, based on the vulnerability information and corresponding vulnerability handling information in the vulnerability scan results, the remediation characteristics corresponding to the problematic code can be determined. The problematic code and the remediation context are then examined to determine whether remediation characteristics exist. If remediation characteristics exist, the problematic code has been rectified; if remediation characteristics do not exist, the problematic code has not been rectified, and the vulnerability has not been patched.

[0109] Optionally, based on the vulnerability information and corresponding vulnerability handling information in the vulnerability scan results, the vulnerability characteristics and remediation characteristics corresponding to the problematic code can be determined. The problematic code and its remediation context are then examined to determine if either the vulnerability characteristic or the remediation characteristic exists. The method for determining the vulnerability characteristic and remediation characteristic is the same as above.

[0110] This solution utilizes a vulnerability database to enable rapid querying of target characteristics, further improving the speed of remediation result detection and thus enhancing the efficiency of vulnerability processing information verification. By detecting whether target characteristics exist in the remediation code and remediation context, and specifying the target characteristics as remediation features and / or vulnerability features, the solution detects the completion status of remediation code remediation, further improving the efficiency of vulnerability processing information verification.

[0111] In an optional embodiment of the present invention, after obtaining the vulnerability repair verification result, the method further includes: when the vulnerability repair verification result is successful, obtaining the vulnerability type, vulnerability code, and repair issue code corresponding to the rectification status in the vulnerability handling status; querying the repair features and vulnerability features of the vulnerability type corresponding to the rectification status in the vulnerability database; updating the vulnerability features of the vulnerability type corresponding to the rectification status based on the vulnerability code corresponding to the rectification status; and updating the repair features of the vulnerability type corresponding to the repair issue code based on the repair issue code corresponding to the rectification status.

[0112] The vulnerability code and the fix code represent the results before and after the vulnerability code has been processed.

[0113] Specifically, when the vulnerability remediation verification result is successful, it can be understood that the problematic code has been rectified. At this point, the vulnerability type, vulnerable code, and remediation code corresponding to the rectified status can be obtained. In the vulnerability database, based on the vulnerability type corresponding to the rectified status, the corresponding remediation features and vulnerability features can be queried. Based on the features of the vulnerable code corresponding to the rectified status, the vulnerability features for that vulnerability type are updated. Based on the features of the remediation code corresponding to the rectified status, the remediation features for that vulnerability type are updated, thus updating the vulnerability database.

[0114] This solution updates the vulnerability database by obtaining the vulnerability type, vulnerability code, and fix code corresponding to the rectification status after the vulnerability remediation verification result is successful. It then queries the vulnerability database for the remediation features and vulnerability characteristics corresponding to the rectification status. Finally, it updates the vulnerability characteristics of the vulnerability type corresponding to the rectification status based on the vulnerability code and the fix code, thereby increasing the data in the vulnerability database and improving the accuracy of detecting target features based on the vulnerability database.

[0115] In an optional embodiment of the present invention, detecting whether the repair code and the repair context have target features further includes: when the vulnerability type is empty, sending a rectification detection request to the manual processing module so that the operation and maintenance user can detect whether the repair code has been rectified; or calling the vulnerability scanning system to perform a repair vulnerability scan on the repair code, obtaining the repair vulnerability scan results, and detecting whether the repair code has vulnerabilities.

[0116] A void vulnerability type means that no vulnerability of the specified type was found in the vulnerability database. Operations and maintenance users are the personnel who perform remediation and testing on the code to fix the issues. A vulnerability scanning system is a system used to detect vulnerabilities in business code and generate vulnerability scan results. The vulnerability scan result refers to the result obtained from detecting vulnerabilities in the code to fix the issues.

[0117] Specifically, when the vulnerability type is empty, a remediation and detection request can be sent to the user using the manual processing module, allowing the operations and maintenance user to check the code for fixing the problem; alternatively, a vulnerability scanning system can be invoked to scan the code for fixing the problem and obtain the vulnerability scan results. If the vulnerability scan result indicates that no vulnerability exists, the code for fixing the problem has been remediated; if the vulnerability scan result indicates that a vulnerability exists, the code for fixing the problem has not been remediated.

[0118] After the operation and maintenance user or the vulnerability scanning system detects the code that fixes the problem, if the vulnerability fix verification result is successful, the vulnerability code, the characteristics corresponding to the vulnerability code, the code that fixes the problem, and the characteristics corresponding to the code that fixes the problem are added to the vulnerability database.

[0119] This solution sends a remediation and detection request to the manual processing module when the vulnerability type is empty, allowing operations and maintenance users to check whether the code that fixed the problem has been rectified; or it calls the vulnerability scanning system to scan the code that fixed the problem for vulnerabilities, obtains the results of the vulnerability scan, and checks whether the code that fixed the problem has vulnerabilities. By combining manual processing and the vulnerability scanning system, this solution enables the detection of the code that fixed the problem when the vulnerability type is empty, improving the fault tolerance of the verification of vulnerability processing information.

[0120] In an optional embodiment of the present invention, querying and fixing the target features corresponding to the vulnerability type of the problematic code in the vulnerability database includes: obtaining business operation constraint information of the business code; and querying and fixing the target features corresponding to the vulnerability type of the problematic code in the vulnerability database based on the business operation constraint information.

[0121] Specifically, when querying and fixing the target features corresponding to the vulnerability types of problematic code in the vulnerability database, business operation constraint information of the business code can be obtained. Based on the business operation constraint information, the target features corresponding to the vulnerability types of problematic code queried in the vulnerability database can be further filtered to obtain target features that meet the business operation constraint information.

[0122] This solution obtains the business operation constraint information of the business code, queries and repairs the target features corresponding to the vulnerability types of the problematic code in the vulnerability database based on the business operation constraint information, further filters the target features corresponding to the vulnerability types, and detects the problematic code and repair context based on the filtered target features, thereby further improving the efficiency of repair result detection.

[0123] Figure 4 This is a scenario diagram illustrating a vulnerability processing result verification method provided in an embodiment of the present invention. See also... Figure 4 The vulnerability handling result verification method shown includes:

[0124] Step 1: Obtain the scan results.

[0125] like Figure 4 As shown, the vulnerability scanning results generated by the vulnerability scanning system are obtained.

[0126] Step II: Identify audit activities and audit processes.

[0127] like Figure 4 As shown, auditing activities may include marking vulnerability scanning results with vulnerability handling status and generating results showing the vulnerability code has been patched. The auditing process may include processing the vulnerability scanning results for a specific number of times.

[0128] Step III: Learning and Analysis.

[0129] like Figure 4 As shown, the types of vulnerabilities with false positive status can be classified manually, and the characteristics of the vulnerability scan results corresponding to each vulnerability type can be identified for analysis. The reasons for repeated audits can also be analyzed manually, identifying issues with the standardization of vulnerability handling status and incomplete remediation of bug fixes. This involves determining the data formats and content of vulnerability handling statuses that do not conform to standard testing, as well as identifying the vulnerability characteristics of incompletely remediated bug fixes. Simultaneously, the remediation characteristics of thoroughly remediated bug fixes are analyzed. The vulnerability scan results and corresponding vulnerability handling information are input into the model for training. The model is then corrected based on the manual verification results of the vulnerability handling information until a valid model is obtained.

[0130] The vulnerability types can include: SQL (Structured Query Language) injection, password management, and cross-site scripting attacks.

[0131] Step IV: Automated Auditing.

[0132] like Figure 4As shown, based on the trained verification model, automated auditing of vulnerability handling information can be achieved in the above embodiments.

[0133] This solution analyzes and learns from the repair and verification results of vulnerability handling information, thereby training a verification model. The verification model then enables an automated auditing process for vulnerability handling information.

[0134] It should be noted that for any parts not described in detail in the embodiments of the present invention, please refer to the description in the foregoing embodiments.

[0135] Figure 5 This is a schematic diagram of a vulnerability processing result verification device provided in an embodiment of the present invention. This embodiment is applicable to situations where vulnerability processing result verification is performed without human intervention. The device can execute vulnerability processing result verification methods and can be implemented in hardware and / or software. This vulnerability processing result verification device can be configured in electronic devices, especially in client-side applications.

[0136] See Figure 5 The vulnerability processing result verification device shown includes: a vulnerability scan result acquisition module 510, a vulnerability processing information acquisition module 520, a vulnerability processing information verification module 530, and a re-repair information sending module 540. Among them,

[0137] The vulnerability scan result acquisition module 510 is used to acquire the vulnerability scan results obtained by the vulnerability scanning system from scanning the business code;

[0138] The vulnerability handling information acquisition module 520 is used to acquire the vulnerability scanning results processed by the operation and maintenance users and obtain the vulnerability handling information corresponding to the vulnerability scanning results. The vulnerability handling information includes the result after the vulnerability code is repaired and the vulnerability handling status.

[0139] The vulnerability processing information verification module 530 is used to verify the vulnerability processing information corresponding to the vulnerability scanning results based on the vulnerability scanning results and the corresponding vulnerability processing information, and to obtain the vulnerability remediation verification result; the verification includes at least one of the following: standardization verification, correctness verification and remediation result verification.

[0140] The re-repair information sending module 540 is used to send re-repair information to the operation and maintenance user when the vulnerability repair verification result is a failure, so that the operation and maintenance user can process the vulnerability scan results corresponding to the re-repair information.

[0141] The technical solution of this invention obtains vulnerability scanning results from a vulnerability scanning system targeting business code, and then allows operations and maintenance users to process these results to obtain vulnerability handling information corresponding to the vulnerability scanning results. This vulnerability handling information includes a vulnerability handling status. Based on the vulnerability scanning results and the corresponding vulnerability handling information, the vulnerability handling information is verified to obtain a vulnerability remediation verification result. This verification includes at least one of the following: compliance verification, correctness verification, and remediation result verification. If the vulnerability remediation verification result fails, remediation information is sent to the operations and maintenance user so that the user can process the vulnerability scanning results corresponding to the remediation information. By automatically verifying the vulnerability handling information, the verification of vulnerability handling results is automated, improving the efficiency of vulnerability handling result verification and ensuring the security and stability of the system.

[0142] In an optional embodiment of the present invention, after obtaining the vulnerability repair verification result, the device further includes: a performance acquisition module, used to acquire the performance of the business system running the business code and determine the operation constraint information of the business code; a problematic code acquisition module, used to acquire the problematic code corresponding to the vulnerability scan result that failed the verification; and a vulnerability repair verification result modification module, used to modify the vulnerability repair verification result of the vulnerability scan result that failed the verification to a successful verification when the problematic code corresponding to the problematic code of the vulnerability scan result that failed the verification meets the business operation constraint information.

[0143] In an optional embodiment of the present invention, the verification includes standardization verification. The vulnerability processing information verification module 530 includes: a standardization detection unit, used to perform standardization detection on the data format and content of the vulnerability processing status.

[0144] In an optional embodiment of the present invention, the verification includes correctness verification. The vulnerability processing information verification module 530 includes: a false alarm result determination unit, used to perform vulnerability detection on the false alarm problem code corresponding to the false alarm status in the vulnerability processing status, and determine whether the vulnerability scanning result corresponding to the false alarm problem code is a false alarm result.

[0145] In an optional embodiment of the present invention, the false positive result determination unit includes: a false positive issue code acquisition subunit, configured to acquire the false positive issue code and false positive context corresponding to the false positive status in the vulnerability handling information; a false positive issue code detection subunit, configured to detect whether the false positive issue code and false positive context have features of a vulnerability scanning result corresponding to the false positive issue code; a vulnerability detection result determination subunit, configured to determine the vulnerability scanning result corresponding to the false positive issue code as a vulnerability detection result if it exists; and a false positive result determination subunit, configured to determine the vulnerability scanning result of the false positive issue code as a false positive result if it does not exist.

[0146] In an optional embodiment of the present invention, the verification includes a repair result verification. The vulnerability processing information verification module 530 includes: a repair problem code acquisition unit, used to acquire the repair problem code corresponding to the rectification status in the vulnerability processing status; and a repair problem code detection unit, used to detect whether the repair problem code has been rectified.

[0147] In an optional embodiment of the present invention, the problem code detection unit includes: a vulnerability type acquisition subunit, used to acquire the vulnerability type of the problem code in the vulnerability scan results; a target feature query subunit, used to query the target feature corresponding to the vulnerability type of the problem code in the vulnerability database; and a target feature detection subunit, used to detect whether the problem code and the repair context have target features, wherein the target features include repair features and / or vulnerability features.

[0148] In an optional embodiment of the present invention, after the target feature detection subunit obtains the vulnerability repair verification result, the target feature detection subunit is further specifically configured to: when the vulnerability repair verification result is successful, obtain the vulnerability type, vulnerability code, and repair issue code corresponding to the rectification status in the vulnerability handling status; query the repair features and vulnerability features of the vulnerability type corresponding to the rectification status in the vulnerability database; update the vulnerability features of the vulnerability type corresponding to the rectification status according to the vulnerability code corresponding to the rectification status; and update the repair features of the vulnerability type corresponding to the rectification status according to the repair issue code corresponding to the rectification status.

[0149] In an optional embodiment of the present invention, the target feature query subunit is specifically used for: obtaining business operation constraint information of business code; and querying and fixing the target features corresponding to the vulnerability type of the problematic code in the vulnerability database based on the business operation constraint information.

[0150] In an optional embodiment of the present invention, the vulnerability processing information verification module 530 includes: a verification model verification unit, used to input the vulnerability scanning results and the corresponding vulnerability processing information into a pre-trained verification model to obtain vulnerability repair verification results; the verification model is trained based on training samples, the training samples including the vulnerability scanning results of sample code, the vulnerability processing information corresponding to the vulnerability scanning results of the sample code, and the vulnerability repair verification results of the vulnerability scanning results of the sample code.

[0151] In an optional embodiment of the present invention, the verification model verification unit is specifically used for: obtaining the operating performance of the business system running the business code, and determining the business operation constraint information of the business code; inputting the vulnerability scanning results, the corresponding vulnerability handling information and the business code operation constraint information into the pre-trained verification model to obtain the vulnerability repair verification result; the training samples also include the business operation constraint information of the sample code.

[0152] In an optional embodiment of the present invention, the device further includes: a false positive issue code acquisition module, used to acquire the false positive issue code corresponding to the false positive status in the vulnerability handling status when the vulnerability repair verification result is successful; a candidate vulnerability scanning software detection module, used to detect the accuracy of candidate vulnerability scanning software based on the false positive issue code; a target vulnerability scanning software filtering module, used to filter out target vulnerability scanning software based on the accuracy detection results; and a vulnerability scanning system optimization module, used to optimize the vulnerability scanning system based on the information associated with the target vulnerability scanning software and the information associated with the false positive issue code.

[0153] The vulnerability processing result verification device provided in this embodiment of the invention can execute the vulnerability processing result verification method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0154] It should be noted that for any parts not described in detail in the embodiments of the present invention, please refer to the description in the foregoing embodiments.

[0155] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Figure 6 A block diagram is shown that is suitable for implementing embodiments of the present invention. Figure 6 The device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0156] like Figure 6 As shown, the electronic device 12 is represented in the form of a general-purpose computing device. The components of the electronic device 12 may include, but are not limited to: one or more processors or processing units 16, system memory 28, and bus 18 connecting different system components (including system memory 28 and processing unit 16).

[0157] Bus 18 represents one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus using any of the various bus architectures. For example, these architectures include, but are not limited to, the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MAC) bus, the Enhanced ISA bus, the Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnect (PCI) bus.

[0158] Electronic device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by electronic device 12, including volatile and non-volatile media, removable and non-removable media.

[0159] System memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory (cache 32). Electronic device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 34 may be used to read and write non-removable, non-volatile magnetic media (… Figure 6 Not shown; usually referred to as a "hard drive"). Although Figure 6 Not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk") and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to bus 18 via one or more data media interfaces. System memory 28 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of various embodiments of the present invention.

[0160] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in system memory 28. Such program modules 42 include, but are not limited to, an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include an implementation of a network environment. Program modules 42 typically perform the functions and / or methods described in the embodiments of this invention.

[0161] Electronic device 12 can also communicate with one or more external devices 14 (e.g., keyboard, pointing device, display 24, etc.), and with one or more devices that enable a user to interact with electronic device 12, and / or with any device that enables electronic device 12 to communicate with one or more other computing devices (e.g., network card, modem, etc.). This communication can be performed via input / output (I / O) interface 22. Furthermore, electronic device 12 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 20. As shown, network adapter 20 communicates with other modules of electronic device 12 via bus 18. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 12, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0162] The processing unit 16 executes various functional applications and data processing by running programs stored in the system memory 28, such as implementing the vulnerability processing result verification method provided in the embodiments of the present invention.

[0163] This invention also provides a computer-readable storage medium storing a computer program (or computer-executable instructions) thereon, which, when executed by a processor, is used to perform the vulnerability processing result verification method provided in this invention.

[0164] The computer storage medium of this invention can be any combination of one or more computer-readable media. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0165] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of sending, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0166] Program code contained on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0167] Computer program code for performing the operations of embodiments of the present invention can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0168] This invention also provides a computer program product, including a computer program that, when executed by a processor, implements the vulnerability processing result verification method provided in any embodiment of this application.

[0169] In implementing the computer program product, computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0170] Note that the above description is merely a preferred embodiment of the present invention and the technical principles employed. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments, and may include many other equivalent embodiments without departing from the concept of the present invention, the scope of which is determined by the scope of the appended claims.

Claims

1. A method for verifying vulnerability processing results, characterized in that, include: Obtain vulnerability scan results from the vulnerability scanning system that scans the business code; The system obtains and processes the vulnerability scan results from the operation and maintenance user to obtain vulnerability handling information corresponding to the vulnerability scan results, wherein the vulnerability handling information includes the vulnerability handling status. Based on the vulnerability scanning results and the corresponding vulnerability handling information, the vulnerability handling information corresponding to the vulnerability scanning results is verified to obtain vulnerability remediation verification results; the verification includes at least one of the following: standardization verification, correctness verification, and remediation result verification; When the vulnerability repair verification result is a failure, a re-repair information is sent to the operation and maintenance user so that the operation and maintenance user can process the vulnerability scan result corresponding to the re-repair information; After obtaining the vulnerability remediation verification results, the process also includes: Obtain the runtime performance of the business system running the business code, and determine the business runtime constraint information of the business code; Obtain the problematic code corresponding to the vulnerability scan results that failed verification; When the problematic code corresponding to the failed vulnerability scan result satisfies the business operation constraint information, the vulnerability repair verification result of the failed vulnerability scan result is corrected to successful verification.

2. The method according to claim 1, characterized in that, The verification includes normative verification, and the verification of the vulnerability handling status includes: The data format and content of the vulnerability handling status are standardized and tested.

3. The method according to claim 1, characterized in that, The verification includes a correctness verification, and the verification of the vulnerability handling status includes: Vulnerability detection is performed on the false alarm issue code corresponding to the false alarm status in the vulnerability handling status to determine whether the vulnerability scan result corresponding to the false alarm issue code is a false alarm result.

4. The method according to claim 3, characterized in that, The step of performing vulnerability detection on the falsely reported vulnerability code corresponding to the falsely reported vulnerability status in the vulnerability handling status, and determining whether the vulnerability scan result corresponding to the falsely reported vulnerability code is a false alarm result, includes: Obtain the false alarm issue code and false alarm context corresponding to the false alarm status in the vulnerability handling information; The feature of detecting whether the falsely reported vulnerability code and the falsely reported context have a vulnerability scan result corresponding to the falsely reported vulnerability code; If it exists, then the vulnerability scan result corresponding to the false positive issue code is determined as the vulnerability detection result; If it does not exist, then the vulnerability scan result of the problematic code that was falsely reported is determined to be a false report.

5. The method according to claim 1, characterized in that, The verification includes verification of the repair results, which verifies the problematic code corresponding to the vulnerability scan results, including: Obtain the code for fixing the issue corresponding to the rectification status in the vulnerability handling status; Check whether the code that was supposed to fix the problem has been rectified.

6. The method according to claim 5, characterized in that, The process of detecting whether the code that fixes the problem has been rectified includes: Obtain the vulnerability type of the code that fixes the problem from the vulnerability scan results; Search the vulnerability database for the target characteristics corresponding to the vulnerability type of the patched code; The system detects whether the problem-fixing code and the fix context contain target features, including fix features and / or vulnerability features.

7. The method according to claim 6, characterized in that, After obtaining the vulnerability remediation verification results, the following is also included: When the vulnerability remediation verification result is successful, obtain the vulnerability type, vulnerability code, and remediation code corresponding to the rectification status in the vulnerability handling status; In the vulnerability database, query the remediation features and vulnerability features of the vulnerability type corresponding to the remediation status; Based on the vulnerability code corresponding to the rectification status, update the vulnerability features of the vulnerability type corresponding to the rectification status; Based on the repair issue code corresponding to the rectification status, update the repair features for the vulnerability type corresponding to the rectification status.

8. The method according to claim 6, characterized in that, The step of querying the vulnerability database for target features corresponding to the vulnerability type of the patched code includes: Obtain the business operation constraint information of the business code; Based on the business operation constraint information, query the vulnerability database for the target features corresponding to the vulnerability type of the fix code.

9. The method according to claim 1, characterized in that, The step of verifying the vulnerability processing information corresponding to the vulnerability scanning results based on the vulnerability scanning results and the corresponding vulnerability processing information to obtain vulnerability remediation verification results includes: The vulnerability scan results and corresponding vulnerability handling information are input into a pre-trained verification model to obtain vulnerability remediation verification results. The verification model is trained based on training samples, which include vulnerability scan results of sample code, vulnerability handling information corresponding to the vulnerability scan results of the sample code, and vulnerability remediation verification results of the vulnerability scan results of the sample code.

10. The method according to claim 9, characterized in that, The step of inputting the vulnerability scan results and corresponding vulnerability handling information into a pre-trained verification model to obtain vulnerability remediation verification results includes: Obtain the runtime performance of the business system running the business code, and determine the business runtime constraint information of the business code; The vulnerability handling information corresponding to the vulnerability scan results and the business operation constraint information of the business code are input into the pre-trained verification model to obtain the vulnerability repair verification results; the training samples also include the business operation constraint information of the sample code.

11. The method according to claim 1, characterized in that, Also includes: When the vulnerability repair verification result is successful, obtain the false alarm issue code corresponding to the false alarm status in the vulnerability handling status; Based on the false positive issue codes, the accuracy of the alternative vulnerability scanning software is tested; Based on the accuracy test results, the target vulnerability scanning software was selected. The vulnerability scanning system is optimized based on the information associated with the target vulnerability scanning software and the information associated with the false positive vulnerability code.

12. A vulnerability processing result verification device, characterized in that, include: The vulnerability scan result acquisition module is used to acquire the vulnerability scan results obtained by the vulnerability scanning system from scanning the business code; The vulnerability handling information acquisition module is used to acquire the vulnerability scanning results processed by the operation and maintenance user to obtain the vulnerability handling information corresponding to the vulnerability scanning results. The vulnerability handling information includes the result after the vulnerability code is repaired and the vulnerability handling status. The vulnerability handling information verification module is used to verify the vulnerability handling information corresponding to the vulnerability scanning results based on the vulnerability scanning results and the corresponding vulnerability handling information, so as to obtain the vulnerability remediation verification result; the verification includes at least one of the following: standardization verification, correctness verification and remediation result verification; The re-repair information sending module is used to send re-repair information to the operation and maintenance user when the vulnerability repair verification result is a verification failure, so that the operation and maintenance user can process the vulnerability scan result corresponding to the re-repair information; After obtaining the vulnerability remediation verification result, the device further includes: The runtime performance acquisition module is used to acquire the runtime performance of the business system running the business code and determine the business runtime constraint information of the business code; The problematic code acquisition module is used to obtain the problematic codes corresponding to the vulnerability scan results that failed to verify. The vulnerability repair verification result modification module is used to modify the vulnerability repair verification result of the failed vulnerability scan result to a successful verification result when the problematic code corresponding to the failed vulnerability scan result meets the business operation constraint information.

13. An electronic device, characterized in that, The system includes a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, when the processor executes the computer program, it implements the vulnerability processing result verification method as described in any one of claims 1-11.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the vulnerability processing result verification method as described in any one of claims 1-11.

15. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the vulnerability processing result verification method as described in any one of claims 1-11.

Images